sql injection risk when when using order.

[levansuper]

Test.findAndCountAll({
where: { id :1 },
order : [['id', 'DESC; delete from test;']]
})

when the client sends parameters of which columns should be ordered with there is a risk of sql injection.
this works with PostgreSQL. I haven't tested with other databases though.

[mickhansen]

It's likely safe to assume that the second argument of an order statement could only ever be ASC or DESC

[Zolmeister]

Please update npm
https://nodesecurity.io/advisories/sequelize-sql-injection-order

[mickhansen]

@Zolmeister We will. Can always use a git reference in the meantime.

[mickhansen]

I will likely push a new NPM version after i fix #2969 tonight.